UL HPC School 2017 PS1: Getting Started on the UL HPC platform UL High Performance Computing (HPC) Team C. Parisot University of Luxembourg (UL), Luxembourg http://hpc.uni.lu C. Parisot (University of Luxembourg) UL HPC School 2017 1 / 22 �
Latest versions available on Github : UL HPC tutorials: https://github.com/ULHPC/tutorials UL HPC School: http://hpc.uni.lu/hpc-school/ PS1 tutorial sources: https://github.com/ULHPC/tutorials/tree/devel/basic/getting_started C. Parisot (University of Luxembourg) UL HPC School 2017 2 / 22 �
Introduction Summary 1 Introduction 2 SSH Secure Shell 3 Hands-On: Getting Started on ULHPC C. Parisot (University of Luxembourg) UL HPC School 2017 3 / 22 �
Introduction Main Objectives of this Session Understand SSH Connect to the UL HPC Platform → SSH configuration ֒ → Generate your SSH key pair ֒ → overcome port filtering ֒ Discovering, visualizing and reserving UL HPC resources → Working environment ֒ → Web monitoring interfaces ֒ → OAR vs. SLURM Batch Scheduler ֒ → Job management ֒ → Software / Environement Modules ֒ C. Parisot (University of Luxembourg) UL HPC School 2017 4 / 22 �
SSH Secure Shell Summary 1 Introduction 2 SSH Secure Shell 3 Hands-On: Getting Started on ULHPC C. Parisot (University of Luxembourg) UL HPC School 2017 5 / 22 �
SSH Secure Shell SSH: Secure Shell Ensure secure connection to remote (UL) server → establish encrypted tunnel using asymmetric keys ֒ � Public id_rsa.pub vs. Private id_rsa ( without .pub ) � typically on a non-standard port ( Ex : 8022) limits kiddie script � Basic rule: 1 machine = 1 key pair → the private key is SECRET : never send it to anybody ֒ � Can be protected with a passphrase C. Parisot (University of Luxembourg) UL HPC School 2017 6 / 22 �
SSH Secure Shell SSH: Secure Shell Ensure secure connection to remote (UL) server → establish encrypted tunnel using asymmetric keys ֒ � Public id_rsa.pub vs. Private id_rsa ( without .pub ) � typically on a non-standard port ( Ex : 8022) limits kiddie script � Basic rule: 1 machine = 1 key pair → the private key is SECRET : never send it to anybody ֒ � Can be protected with a passphrase SSH is used as a secure backbone channel for many tools → Remote shell i.e remote command line ֒ → File transfer: rsync , scp , sftp ֒ → versionning synchronization ( svn , git ), github, gitlab etc. ֒ C. Parisot (University of Luxembourg) UL HPC School 2017 6 / 22 �
SSH Secure Shell SSH: Secure Shell Ensure secure connection to remote (UL) server → establish encrypted tunnel using asymmetric keys ֒ � Public id_rsa.pub vs. Private id_rsa ( without .pub ) � typically on a non-standard port ( Ex : 8022) limits kiddie script � Basic rule: 1 machine = 1 key pair → the private key is SECRET : never send it to anybody ֒ � Can be protected with a passphrase SSH is used as a secure backbone channel for many tools → Remote shell i.e remote command line ֒ → File transfer: rsync , scp , sftp ֒ → versionning synchronization ( svn , git ), github, gitlab etc. ֒ Authentication: → password (disable if possible) ֒ → ( better ) public key authentication ֒ C. Parisot (University of Luxembourg) UL HPC School 2017 6 / 22 �
SSH Secure Shell SSH: Public Key Authentication Client Local Machine local homedir ~/.ssh/ owns local private key id_rsa id_rsa .pub logs known servers known_hosts C. Parisot (University of Luxembourg) UL HPC School 2017 7 / 22 �
SSH Secure Shell SSH: Public Key Authentication Client Server Local Machine Remote Machine local homedir remote homedir ~/.ssh/ ~/.ssh/ knows granted owns local private key authorized_keys id_rsa (public) key id_rsa .pub logs known servers known_hosts C. Parisot (University of Luxembourg) UL HPC School 2017 7 / 22 �
SSH Secure Shell SSH: Public Key Authentication Client Server Local Machine Remote Machine local homedir remote homedir ~/.ssh/ ~/.ssh/ knows granted owns local private key authorized_keys id_rsa (public) key id_rsa .pub SSH server config /etc/ssh/ sshd_config logs known servers known_hosts ssh_host_rsa_key ssh_host_rsa_key .pub C. Parisot (University of Luxembourg) UL HPC School 2017 7 / 22 �
SSH Secure Shell SSH: Public Key Authentication Client Server Local Machine Remote Machine local homedir remote homedir ~/.ssh/ ~/.ssh/ knows granted owns local private key authorized_keys id_rsa (public) key id_rsa .pub C. Parisot (University of Luxembourg) UL HPC School 2017 7 / 22 �
SSH Secure Shell SSH: Public Key Authentication Client Server Local Machine Remote Machine local homedir remote homedir ~/.ssh/ ~/.ssh/ 1. Initiate connection knows granted owns local private key authorized_keys id_rsa (public) key 2. create random challenge, “encrypt” using public key id_rsa .pub 3. solve challenge using private key return response 4. allow connection iff response == challenge Restrict to public key authentication: /etc/ssh/sshd_config : PermitRootLogin no # Enable Public key auth. # Disable Passwords RSAAuthentication yes PasswordAuthentication no PubkeyAuthentication yes ChallengeResponseAuthentication no C. Parisot (University of Luxembourg) UL HPC School 2017 7 / 22 �
SSH Secure Shell SSH Setup on Linux / Mac OS OpenSSH natively supported; configuration directory : ~/.ssh/ → package openssh-client (Debian-like) or ssh (Redhat-like) ֒ SSH Key Pairs (public vs private) generation: ssh-keygen → specify a strong passphrase ֒ � protect your private key from being stolen i.e. impersonation � drawback: passphrase must be typed to use your key C. Parisot (University of Luxembourg) UL HPC School 2017 8 / 22 �
SSH Secure Shell SSH Setup on Linux / Mac OS OpenSSH natively supported; configuration directory : ~/.ssh/ → package openssh-client (Debian-like) or ssh (Redhat-like) ֒ SSH Key Pairs (public vs private) generation: ssh-keygen → specify a strong passphrase ֒ � protect your private key from being stolen i.e. impersonation � drawback: passphrase must be typed to use your key ssh-agent C. Parisot (University of Luxembourg) UL HPC School 2017 8 / 22 �
SSH Secure Shell SSH Setup on Linux / Mac OS OpenSSH natively supported; configuration directory : ~/.ssh/ → package openssh-client (Debian-like) or ssh (Redhat-like) ֒ SSH Key Pairs (public vs private) generation: ssh-keygen → specify a strong passphrase ֒ � protect your private key from being stolen i.e. impersonation � drawback: passphrase must be typed to use your key ssh-agent DSA and RSA 1024 bit are deprecated now! C. Parisot (University of Luxembourg) UL HPC School 2017 8 / 22 �
SSH Secure Shell SSH Setup on Linux / Mac OS OpenSSH natively supported; configuration directory : ~/.ssh/ → package openssh-client (Debian-like) or ssh (Redhat-like) ֒ SSH Key Pairs (public vs private) generation: ssh-keygen → specify a strong passphrase ֒ � protect your private key from being stolen i.e. impersonation � drawback: passphrase must be typed to use your key ssh-agent DSA and RSA 1024 bit are deprecated now! $> ssh-keygen -t rsa -b 4096 -o -a 100 # 4096 bits RSA $> ssh-keygen -t ed25519 -o -a 100 # new sexy Ed25519 (better) Public Key Private (identity) key ~/.ssh/id_{rsa,ed25519} ~/.ssh/id_{rsa,ed25519} .pub C. Parisot (University of Luxembourg) UL HPC School 2017 8 / 22 �
SSH Secure Shell SSH Setup on Windows Putty Suite, includes: http://www.chiark.greenend.org.uk/~sgtatham/putty/ → PuTTY, the free SSH client ֒ → Pageant, an SSH authentication agent for PuTTY tools ֒ → PLink, th PuTTy CLI ֒ → PuTTYgen, an RSA and DSA key generation utility ֒ C. Parisot (University of Luxembourg) UL HPC School 2017 9 / 22 �
SSH Secure Shell SSH Setup on Windows Putty Suite, includes: http://www.chiark.greenend.org.uk/~sgtatham/putty/ → PuTTY, the free SSH client ֒ → Pageant, an SSH authentication agent for PuTTY tools ֒ → PLink, th PuTTy CLI ֒ → PuTTYgen, an RSA and DSA key generation utility ֒ PuTTY � = OpenSSH C. Parisot (University of Luxembourg) UL HPC School 2017 9 / 22 �
SSH Secure Shell SSH Setup on Windows Putty Suite, includes: http://www.chiark.greenend.org.uk/~sgtatham/putty/ → PuTTY, the free SSH client ֒ → Pageant, an SSH authentication agent for PuTTY tools ֒ → PLink, th PuTTy CLI ֒ → PuTTYgen, an RSA and DSA key generation utility ֒ PuTTY � = OpenSSH Putty keys are NOT supported by OpenSSH (yet can be exported) Binding Pageant with OpenSSH agent is NOT natively supported → Third-party tools like ssh-pageant are made for that ֒ → Combine nicely with Git bash ֒ https://git-for-windows.github.io/ with PLink, hostnames eventually refer to PuTTY Sessions → NEVER to SSH entries in ~/.ssh/config ֒ → This usage might be hidden. . . Ex: $GIT_SSH etc. ֒ C. Parisot (University of Luxembourg) UL HPC School 2017 9 / 22 �
SSH Secure Shell SSH Basic Usage *.<domain>-intern.com gitlab bastion1.<domain>.com C. Parisot (University of Luxembourg) UL HPC School 2017 10 / 22 �
SSH Secure Shell SSH Basic Usage *.<domain>-intern.com gitlab bastion1.<domain>.com SSH C. Parisot (University of Luxembourg) UL HPC School 2017 10 / 22 �
Recommend
More recommend
